Privacy Policy - HAYAWAZA Lite

1. Introduction

HAYAWAZA Inc. (registered office: 4F Dai-2 Shirako Bldg., 6-16-7 Nishi-Kasai, Edogawa-ku, Tokyo, Japan; Representative Director: Nobuhito Okochi; hereinafter "the Company", "we", "us", or "our") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our products and services, marketing activities, events, and recruitment activities.

This Policy is designed to comply with the Act on the Protection of Personal Information of Japan ("APPI"), the EU General Data Protection Regulation ("GDPR") and the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), to the extent each applies.

2. Data Controller

The Company acts as the data controller (for GDPR purposes) and the personal information handling business operator (for APPI purposes) of the personal information described in this Policy. For contact details, see the "Contact Us" section below.

If we appoint a representative in the European Union or the United Kingdom pursuant to Article 27 of the GDPR or UK GDPR, the contact details of such representative will be published on our website.

3. Information We Collect

We may collect the following categories of information, either directly from you or automatically through your interaction with our website and software:

Identification and contact details: name, address, employer, department, job title, telephone number, fax number, and email address.
Financial information: bank account details (only where necessary for billing or reimbursement).
User and license information: information relating to your use of our products and services, including license registration data.
Technical information: access logs, IP addresses, and cookie information.
Recruitment-related information: educational and employment history, photographs, and other information you provide when applying for a position with the Company.

4. Purposes of Processing

We use personal information only to the extent necessary for the following purposes. If we intend to use your personal information beyond these purposes, we will obtain your consent.

A. Users and prospective users of our products and services:

To provide information about our products and services.
To administer contracts and manage license agreements.
To issue estimates and invoices for product and service fees.
To send acknowledgements and seasonal greetings.
To notify users of service suspensions, malfunctions, and similar matters.
To contact users by telephone in the event of urgent support needs, service disruptions, or system malfunctions.
To verify user identity and prevent fraudulent use of licenses.
To respond to inquiries and feature requests.
To administer user referral programs.
To provide information about seminars, training, events, campaigns, and surveys.

B. Business partners and their representatives:

To manage business partner information.
To communicate regarding contracts and day-to-day business.
To process invoicing and payments.

C. Job applicants:

To conduct recruitment activities, including screening and interviews.

5. Legal Bases for Processing (GDPR/UK GDPR)

For individuals located in the European Economic Area or the United Kingdom, we rely on the following legal bases for processing personal data under Article 6 of the GDPR:

Performance of a contract: where processing is necessary to provide our products and services under a license agreement or other contract.
Legitimate interests: where we have a legitimate business interest in providing customer support, improving our services, preventing fraud, and ensuring the security of our systems, provided that such interest is not overridden by your rights.
Consent: where you have provided consent for specific processing activities (such as receiving marketing communications). You may withdraw your consent at any time.
Legal obligation: where processing is necessary to comply with applicable laws or regulatory requirements.

6. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy or as required by applicable law.

License and user information: retained during the term of the license and for a reasonable period thereafter for support, warranty, and legal purposes.
Business partner and contract-related information: retained for the period required by applicable tax and accounting laws (typically 7 to 10 years in Japan).
Recruitment information: retained for the duration of the recruitment process. Information of unsuccessful applicants will be deleted or anonymized within a reasonable period after the process ends, except where the applicant has consented to further retention.
Access logs and technical information: retained for a limited period as necessary for security and system administration.

When personal information is no longer required, we will delete or anonymize it in a secure manner.

7. Third-Party Disclosure and Processors

We do not sell, share, or otherwise disclose personal information to third parties without your prior consent, except in the following cases:

To service providers who process personal information on our behalf (e.g., cloud hosting, email delivery, payment processing), subject to appropriate contractual and technical safeguards.
To the extent required by applicable law or by a competent authority.
To protect the rights, property, or safety of the Company, our users, or others.

For purposes of the CCPA/CPRA, we do not "sell" or "share" personal information as those terms are defined thereunder.

8. Joint Use

We do not engage in the joint use of personal information (as that concept is defined under the APPI) with any third party.

9. International Data Transfers

The Company is located in Japan and stores personal information primarily on servers located in Japan. If you access our services from outside Japan, your personal information will be transferred to and processed in Japan.

For transfers of personal data from the European Economic Area or the United Kingdom to Japan, we rely on the adequacy decision issued by the European Commission (and, for the United Kingdom, the adequacy regulations) recognizing Japan as providing an adequate level of protection for personal data.

Where personal information is transferred to service providers located outside Japan, we will implement appropriate safeguards such as standard contractual clauses or equivalent measures as required by applicable law.

10. Security Measures

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include internal policies, employee training, access controls, and regular reviews.

11. Cookies and Similar Technologies

Our website may use cookies and similar technologies for the following purposes:

Strictly necessary cookies: required for the basic operation of the website.
Functional cookies: used to remember your preferences.
Analytics cookies: used to understand how visitors interact with our website in order to improve it.

Except for strictly necessary cookies, we will use non-essential cookies only where required by law with your consent, which you may withdraw at any time by adjusting your browser settings or by contacting us.

12. Your Rights

Depending on the applicable law, you may have the following rights with respect to your personal information:

Under the GDPR and UK GDPR (EEA and UK residents):

Right of access to your personal data.
Right to rectification of inaccurate or incomplete data.
Right to erasure ("right to be forgotten").
Right to restrict processing.
Right to data portability.
Right to object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint with a data protection supervisory authority in your country of residence.

Under the CCPA/CPRA (California residents):

To the extent we collect personal information from California residents, we may collect the following categories of personal information as defined under the CCPA/CPRA:

Identifiers: name, email address, telephone number, address, IP address, and cookie identifiers;
Customer records information: bank account details (only when necessary for billing);
Commercial information: information relating to products and services used or considered;
Internet or network activity information: access logs and cookie information;
Professional or employment-related information: employer, department, and job title;
Education information: educational history (collected only during recruitment).

We do not sell or share the above information as those terms are defined under the CCPA/CPRA. California residents have the following rights:

Right to know what personal information we collect, use, disclose, and (if applicable) sell or share.
Right to delete personal information we have collected from you, subject to certain exceptions.
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of personal information (although we do not sell or share personal information).
Right to non-discrimination for exercising your rights.

Under the APPI (Japan):

Right to request disclosure, correction, addition, or deletion of retained personal data.
Right to request the suspension of use or of provision to third parties.

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning individuals.

13. How to Exercise Your Rights

To exercise any of the rights described above, please contact us using the details in the "Contact Us" section below. We may need to verify your identity before responding to your request. We will respond within the time period required by applicable law.

14. Contact Us

For any questions, requests, or complaints regarding this Policy or our handling of personal information, please contact:

HAYAWAZA Inc. — Administration Department, Personal Information Inquiry Desk
Email: support@hayawaza.co.jp
4F Dai-2 Shirako Bldg., 6-16-7 Nishi-Kasai, Edogawa-ku, Tokyo, Japan

15. Complaints to Supervisory Authorities

If you are located in the European Economic Area or the United Kingdom and believe that our processing of your personal data infringes applicable law, you have the right to lodge a complaint with your local data protection supervisory authority.

If you are located in Japan, you may also contact the Personal Information Protection Commission of Japan.

16. Changes to This Policy

We may amend this Policy from time to time to reflect changes in applicable law or our business practices. Material changes will be notified through our website or by other appropriate means.

17. Effective Date

This Policy is effective as of the date last updated below.

Last updated: June 2026
Nobuhito Okochi, Representative Director, HAYAWAZA Inc.